A Go middleware for parsing X-Forwarded-For and Forwarded headers to correctly identify client IP addresses behind proxies.
XFF is a Go middleware package that parses X-Forwarded-For and Forwarded HTTP headers to extract the original client IP address from requests that pass through proxies or load balancers. It solves the problem of web applications seeing proxy IPs instead of real client addresses, which is critical for accurate logging, security enforcement, and access control.
Go developers building web applications or APIs behind reverse proxies, load balancers, or CDNs who need reliable client IP detection.
Developers choose XFF because it's a lightweight, standards-compliant middleware that integrates seamlessly with Go's net/http package, providing a simple and reliable solution for a common infrastructure problem without adding unnecessary dependencies.
A Golang Middleware to handle X-Forwarded-For Header
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports both legacy X-Forwarded-For and modern RFC 7239 Forwarded headers, ensuring compatibility with diverse proxy setups as highlighted in the README's feature list.
Works directly as middleware with Go's standard HTTP package, demonstrated in the example where it wraps a handler effortlessly.
Offers a ready-to-use default setup via `xff.Default()`, reducing initial integration time and complexity, as shown in the usage example.
Automatically updates the request's RemoteAddr field with the parsed client IP, simplifying logging and access control code without manual intervention.
The minimalist design focuses on defaults, which may not suffice for complex proxy hierarchies or custom header handling, lacking advanced tuning features.
Does not validate IP addresses or verify header integrity, assuming proxies are trusted, which could expose applications to spoofing attacks if misconfigured.
Strictly parses headers without offering integrated tools like rate limiting or logging, requiring developers to implement these separately.